openwebwork / webwork2

Course management front end for WeBWorK
http://webwork.maa.org/wiki/Main_Page
Other
140 stars 164 forks source link

Allow access to the instructor_rpc route without revoking proctor authorization. #2435

Closed drgrice1 closed 1 week ago

drgrice1 commented 3 weeks ago

This fixes a (rather serious) bug in which proctor authorization is revoked when the instructor_rpc endpoint is used by students during a test to get the server time. This means that every single time that a student changes pages or hits preview during a proctored test, the student needs to re-renter the proctor username and password.

The only command that the instructor_rpc allows for student users is this command that gets the server time. All other commands are instructor only, and should be fine to allow without revoking proctor authorization.